An organization needs to configure real-time exporting of Google Cloud Security Command Center (SCC) Premium threat findings to an external SIEM solution operating on-premises. Arrange the steps in the correct operational sequence to implement this security log export architecture.
- 1Enable Security Command Center Premium at the organization level to generate threat detection findings.
- 2Create a Pub/Sub topic and subscription in a dedicated central logging project to serve as the ingestion buffer.
- 3Configure a continuous export rule in Security Command Center targeting the Pub/Sub topic for automated finding streaming.
- 4Deploy a pull subscriber or forwarder service to pull messages from Pub/Sub and stream them securely to the on-premises SIEM.
Cevap
The correct operational sequence is: 1) Enable Security Command Center Premium at the organization level. 2) Create a Pub/Sub topic and subscription in a dedicated project. 3) Configure a continuous export rule in Security Command Center targeting the Pub/Sub topic. 4) Deploy a forwarder service to pull messages from Pub/Sub and stream them to the on-premises SIEM.
The sequence follows standard Cloud Architecture dependencies: first enable the finding source (SCC Premium), then establish the transport messaging buffer (Pub/Sub topic), configure the publishing source to stream to that buffer (SCC Continuous Export), and finally implement the consumer process that delivers findings to the external SIEM.
Adım Adım Çözüm
Anahtar Kavram
Security Command Center Continuous Export to Pub/Sub and External SIEM Integration